Repository navigation
fix(llm): keep claude_cli and codex_cli tasks independent of ambient instructions - #683
Merged
Merged
Conversation
…instructions Claude tasks now pass --safe-mode, so the operator's CLAUDE.md, skills, plugins, hooks and MCP servers no longer reach review tasks; validateArgs rejects a Claude argv without it. Codex tasks pass -c project_doc_max_bytes=0, so the PR head's AGENTS.md no longer becomes instructions for its own review; validateArgs requires it on exec and exec resume. Codex has no flag for the user-level CODEX_HOME AGENTS.md, which the README now documents. Closes #681 Twapp-Session: 46c432b9-3bb2-438f-843f-10e4cd5050d7
monit-reviewer
approved these changes
Oct 21, 2026
monit-reviewer
left a comment
monit-reviewer
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: 2d7c6a39da17
Profile: claude-monit-reviewer - Posting as: monit-reviewer
Summary
| Reviewer | Findings |
|---|---|
| go:implementation-tests | 0 |
| harness-engineering:repo-health | 0 |
| documentation:docs | 0 |
| policies:conventions | 0 |
| security:code-auditor | 0 |
Reviewer Coverage
Complete coverage details are retained in the local coverage.json artifact.
go:implementation-tests— complete (broad); scope: 2 files; examples:internal/llmadapters/subprocess.go,internal/llmadapters/subprocess_test.go; body-inspected: 2 files; examples:internal/llmadapters/subprocess.go,internal/llmadapters/subprocess_test.go; skipped: none; constraints: Tests were not executed; review was static, from the diff and nearby validateArgs code.harness-engineering:repo-health— complete (constrained); scope: 2 files; examples:internal/llmadapters/subprocess.go,internal/llmadapters/subprocess_test.go; body-inspected: 2 files; examples:internal/llmadapters/subprocess.go,internal/llmadapters/subprocess_test.go; skipped: none; constraints: Reviewed the subprocess.go diff in full; subprocess_test.go and README.md were not read in detail (test file inspected only via PR description and diffstat). Tests were read statically; not executed.documentation:docs— complete (broad); scope: 1 file; examples:README.md; body-inspected: 1 file; examples:README.md; skipped: none; context (not coverage): 2 files; examples:docs/review-guidance.md,internal/llmadapters/subprocess.go; constraints: Verified README claims against internal/llmadapters/subprocess.go (--safe-mode, project_doc_max_bytes=0, validateArgs); did not run the adapters or Codex/Claude CLIs.policies:conventions— complete (broad); scope: 1 file; examples:README.md; body-inspected: 1 file; examples:README.md; skipped: none; context (not coverage): 2 files; examples:docs/review-guidance.md,internal/llmadapters/subprocess.go; constraints: Checked README claims against internal/llmadapters/subprocess.go and confirmed docs/review-guidance.md exists; did not run tests or verify CLI flag behavior.security:code-auditor— complete (broad); scope: 2 files; examples:internal/llmadapters/subprocess.go,internal/llmadapters/subprocess_test.go; body-inspected: 2 files; examples:internal/llmadapters/subprocess.go,internal/llmadapters/subprocess_test.go; skipped: none; constraints: Could not verify that the installed claude CLI supports --safe-mode as described; review relied on the PR description and the argv/validation diff. Remaining Codex gap ($CODEX_HOME/AGENTS.md) is documented in the PR and not treated as a regression.
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 3m 36s | ~$2.33 (est.) | claude-sonnet-5-5 | cr 0.10.344
| Field | Value |
|---|---|
| Model | claude-sonnet-5-5 |
| Reviewers | go:implementation-tests, harness-engineering:repo-health, documentation:docs, policies:conventions, security:code-auditor |
| Engine | claude_cli · claude-sonnet-5-5 |
| Reviewed by | cr · monit-reviewer |
| Duration | 3m 36s wall · 7m 24s compute |
| Cost | ~$2.33 (est.) |
| Pricing basis | baseline-2026-10-02/pricing |
| Tokens | 74 in / 9.9k out |
Per-workstream usage
orchestrator-selection— claude-sonnet-5-5- In: 6
- Out: 1.4k
- Cache read: 60.1k
- Cache create: 52.4k
- Cost: ~$0.24 (est.)
- Duration: 39s
go:implementation-tests— claude-sonnet-5-5- In: 10
- Out: 1.5k
- Cache read: 170.4k
- Cache create: 58.4k
- Cost: ~$0.28 (est.)
- Duration: 1m 03s
harness-engineering:repo-health— claude-sonnet-5-5- In: 18
- Out: 2.2k
- Cache read: 401.3k
- Cache create: 141.4k
- Cost: ~$0.67 (est.)
- Duration: 1m 46s
documentation:docs— claude-sonnet-5-5- In: 10
- Out: 1.3k
- Cache read: 162.1k
- Cache create: 53.5k
- Cost: ~$0.26 (est.)
- Duration: 1m 02s
policies:conventions— claude-sonnet-5-5- In: 12
- Out: 1.4k
- Cache read: 208.5k
- Cache create: 53.1k
- Cost: ~$0.27 (est.)
- Duration: 1m 19s
security:code-auditor— claude-sonnet-5-5- In: 10
- Out: 1.3k
- Cache read: 164.3k
- Cache create: 54.8k
- Cost: ~$0.27 (est.)
- Duration: 1m 04s
orchestrator-rollup— claude-sonnet-5-5- In: 8
- Out: 773
- Cache read: 214.9k
- Cache create: 75.9k
- Cost: ~$0.35 (est.)
- Duration: 28s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Keeps
claude_cliandcodex_clitasks from picking up instruction files that are neither in the PR's trusted base branch nor in the agent catalog, matching what #656 did for Pi.--safe-mode, which leaves out the operator'sCLAUDE.md, skills, plugins, hooks and MCP servers while subscription auth, models, built-in tools and permission modes keep working.validateArgsrejects a Claude argv without it.execandexec resumepasses-c project_doc_max_bytes=0, so the PR head'sAGENTS.mdno longer becomes instructions for its own review.validateArgsrequires it.$CODEX_HOME/AGENTS.mdhas no flag, andcrdoes not moveCODEX_HOMEbecause it holds auth), and that repository guidance reaches reviewers through agent prompts.Evidence
Before the change, with the adapters' own argv and marker files:
-p, and--bgfrom the cache workdir with the checkout on--add-dir) received the operator's~/.claude/CLAUDE.md, and did not receive the checkout'sCLAUDE.mdorAGENTS.md.AGENTS.mdand$CODEX_HOME/AGENTS.md.After:
--safe-mode, through both transports and with--enable-auto-mode --permission-mode auto, reported no marker and no user-level instructions, and Read, Write and Bash still worked (it read the checkout'sAGENTS.mdas a file and rangit logthrough Bash).--settings '{"fastMode":true}'is still accepted.-c project_doc_max_bytes=0: the rollout no longer contains the checkout marker; the user-level file is still present, as documented.Tests:
TestSubprocessClaudeIgnoresAmbientInstructionFilesandTestSubprocessCodexIgnoresProjectInstructionFilescover background, resumed and foreground argv, with and without a reviewer workspace, and that validation rejects each argv without its control. The offline-reviewer test now removes only the network config pairs, so it still exercises the network check rather than the new one.Type of Change
Checklist
make tidypassesmake lintpassesmake testpassesmake buildpassesRelated Issues
Closes #681
Model: Claude Opus 5.5 (1M context, xhigh effort) in Claude Code.